Strengthening Cyber Security and Building Trust in the Public Sector Act
Overview
The Ministry of Public and Business Service Delivery, along with the Ministry of Public and Business Service Delivery and Procurement, has released two proposed regulations for public consultation under the Strengthening Cyber Security and Building Trust in the Public Sector Act. These regulations are an important step toward modernizing Ontario’s digital governance and enhancing confidence in how public-sector data, systems, and services are protected.
Both regulatory proposals are now open for comment until February 9, 2026, offering organizations, practitioners, and community stakeholders an opportunity to help shape the province’s future cyber readiness standards. The links to each posting are provided below for easy reference.
The attached document includes the draft regulation texts and the full set of consultation questions to support your review and feedback.
First Regulation
The first is a regulation requiring the development and implementation, and scope of cybersecurity programs for School Boards, Children’s Aid Societies, Acute Care Hospitals, Colleges, and Universities. The regulation includes identifying points of contact for cybersecurity-related matters, the submission of cybersecurity maturity assessments, and reporting requirements on cybersecurity incidents.
Second Regulation
The second regulation that was posted is limited in scope to School Boards and requires notice to students and parents when students’ personal information is given to software companies through software applications in schools.